|
| TC: | 12106 | |
| Description: | OpenSSL is a very popular library supporting SSL and cryptographic functions working on many different platforms. A remote attacker could perform a carefully crafted SSL/TLS handshake against a server configured to use Kerberos ciphersuites in such a way as to cause OpenSSL to crash. Most applications have no ability to use Kerberos ciphersuites and will therefore be unaffected. Versions 0.9.7a, 0.9.7b, and 0.9.7c of OpenSSL are affected by this issue. Any application that makes use of OpenSSL's SSL/TLS library may be affected. Please contact your application vendor for details. | |
| TC Impact: | Gather Info | |
| Service: | http |
| Vulnerability Publication: | March 17, 2004 | |
| Advisory Copyright: | Stephen Henson and the OpenSSL Group. | |
| Summary: | It is possible to create a DoS using a bug in OpenSSL. | |
| Risk: | Medium | |
| CVSS 2.0 metrics: | Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial | |
| CVSS 2.0 Base Score: | 5.0 |
| Vulnerability Impact: |
Denial of Service |
|---|
| Host Impact: | Service can be stopped. | |
| Nature of Remediation: | Update the software. |
| Step required to fix the reported vulnerability: | |
***** Solution type: Upgrade Software ***** Upgrade to OpenSSL 0.9.7d or higher. See references for more details. |
| CVE Link: |
CVE-2004-0112 |
 |
|---|
| Glossary: |
Denial of Service SSL |
|---|
